Keep OSNews alive by becoming a Patreon, by donating through Ko-Fi, or by buying merch!

Nova Custom: this week’s sponsor

Nova Custom, based in The Netherlands, makes laptops focused on privacy, customisation, and freedom. Nova Custom laptops ship with either Linux, Windows, or no operating system, and they’re uniquely certified for Qubes OS (the V54 model will be certified soon), the ultra-secure and private operating system. On top of that, Nova Custom laptops come with Dasharo coreboot firmware preinstalled, which is completely open source, instead of a proprietary BIOS. Nova Custom can also disable the Intel Management Engine for you, and you can opt for Dasharo coreboot+Heads for the ultimate in boot security.

Nova Custom offers visual customisations, too, including engraving a logo or text of your choice on the metal screen lid and/or palmrest and adding your own boot logo. They also offer privacy customisations like removing the microphone and webcam, installing a privacy screen, and more. A small touch I personally appreciate: Nova Custom offers a long, long list of keyboard layouts, as well as the option to customise the super key. Nova Custom products enjoy 3 years of warranty, as well as updates and spare parts for at least seven years after the launch of a product, which includes everything from motherboard replacements down to sets of screws.

Nova Custom laptops can be configured with a wide variety of Intel processor options, as well as a choice between integrated Intel GPUs or Nvidia laptop GPUs. Thanks to Nova Custom for sponsoring OSNews!

The 32bit RISC OS needs to be ported to 64bit to survive, seeks help

RISC OS, the operating system from the United Kingdom originally designed to run on Acorn Computer’s Archimedes computers – the first ARM computers – is still actively developed today. Especially since the introduction of the Raspberry Pi, new life was breathed into this ageing operating system, and it has gained quite a bit of steady momentum ever since, with tons of small updates, applications, and new hardware support, including things like support for wireless networking. This development has always been a bit piecemeal, though, and the pace has never been exceptionally fast.

Now, though, time really is ticking for RISC OS: popular RISC OS platforms like the Raspberry Pi are moving to 64bit ARM only, and this poses a big problem for RISC OS: most of it is written in pure 32bit ARM assembly. As you can imagine, the supply of capable 32bit ARM boards is going to dwindle over the coming years, which would put RISC OS right back where it was before the launch of the Raspberry Pi: floundering, relying on old hardware. This is obviously not ideal, and as such, RISC OS Open Limited wants to take a big leap to address this.

Since 2011, ROOL has successfully delivered dozens of community-funded improvements through its bounty scheme. While this model has enabled steady progress, it is not suited to the scale of work now required to modernise RISC OS. The Moonshots initiative represents a fundamental shift: focused, multi-year development projects undertaken by full-time engineers.

The first Moonshot aims to make the RISC OS source code portable and compatible with 64-bit Arm platforms, a prerequisite for future hardware support. ROOL has already scoped the work, identified key milestones, and built cost models based on realistic employment and project management needs.

↫ Steve Revill in a ROOL press release

They’re going to need a dedicated team of several developers working over the course of several years to port RISC OS to 64bit ARM. That’s going to require quite a bit of money, manpower, and expertise, and considering ROOL has only collected about £100000 worth of donations over the past 14 years, I can see why they’re aiming to go big for this effort. All these giant technology corporations with trillion dollar stock valuations are currently relying on ARM technology, so you’d think they could empty a few socks and cough up a few million to get this effort funded properly, but alas, we all know that’s not going to happen.

I hope ROOL can make this work. RISC OS is a ton of fun to use, and occupies a unique place in computing history. I would be incredibly sad to see technological progress leave it behind, when what amount to chump change for so many wealthy companies and individuals could save it.

Microsoft makes it even harder to use a local account on Windows 11

Do you want to install Windows 11 without internet access or without an online Microsoft Account? It seems Microsoft really doesn’t want you to, as it has removed a very common and popular way of bypassing this requirement. In the release notes for the latest builds from the Dev and Beta channels, the company notes:

We’re removing the bypassnro.cmd script from the build to enhance security and user experience of Windows 11. This change ensures that all users exit setup with internet connectivity and a Microsoft Account.

Let me blow your minds and state that I don’t think online accounts for an operating system are inherently a bad idea. I would love it if I could install Fedora KDE on a new machine, optionally log into some online “Fedora Account”, and have my customisations and applications synchronise automatically. It would save me some time and effort, and assuming it’s all properly encrypted and secured, I don’t think the risk factors are particularly high. The keyword here is, of course, optionally. Microsoft wants every Windows 11 user to have a Microsoft Account instead of a local account, and would rather not make it optional at all.

Of course, this is still Microsoft, a company wholly incapable of doing anything right when it comes to operating systems, so even making this script available again during installation is stupidly easy. It took a few nerds mere moments to discover you could just make some registry changes during installation, reboot, and have the script return to its rightful place.

Oh Microsoft. Never change.

Blue95: Fedora Atomic Xfce converted to a Windows 95 desktop

Blue95 is a modern and lightweight desktop experience that is reminiscent of a bygone era of computing. Based on Fedora Atomic Xfce with the Chicago95 theme.

↫ Blue95 GitHub page

Exactly as it says on the tin. This is by far the easiest way to get the excellent Chigaco95 theme for Xfce set up and working in a polished way, and it also contains a few different application choices from the regular Fedora Xfce desktop to improve the illusion even further.

Microsoft releases Windows 11 roadmap tool to help make sense of Windows 11’s development

I’ve complained about the utter inscrutability of the Windows release process for a long time, with Microsoft seemingly using channels, build numbers, code names, date-based version numbers, and so on interchangeably, making it incredibly hard to keep track of what is being released when. It turns out even Microsoft itself started losing track, because it’s now released a roadmap for Windows 11 development.

In the roadmap tool – of course it’s a tool – you can select a platform, which isn’t x86 or ARM, but Windows PC or Copilot+ PC, a version (23H2 or 24H2 for now), a status (In preview, Gradually rolling out, or Generally available), and a channel (Canary, Dev, Beta, or Retail), after which the roadmap tool will list whatever features match those criteria. Do you now see why people might want such a tool to keep track of what the hell is going on with Windows?

Anyway, as the date-based version numbers – 23H2 and 24H2 – may already make clear, this seems more like a roadmap about where development’s been than where development’s going. The problem for Microsoft, of course, is that it maintains several different Windows variants with different feature sets and update schedules, and users, too, can of course opt to stick to certain versions before moving on. The end result is this spaghetti, which makes it hard to untangle when you’re getting which feature.

Anyway, if you’re elbow-deep in the Windows spaghetti, this tool may be of use to you.

US government’s attack on free speech, science, and research is causing a brain drain

How do you create a brain drain and lose your status as eminent destination for scientists and researchers?

The United States seems to be sending out questionnaires to researchers at universities and research institutes outside of the United States, asking them about their political leanings. Dutch universities are strongly advising Dutch researches not to respond to the questionnaires, and warn that they are designed to stifle free speech and independent research through intimidation.

Universities of the Netherlands (UNL) has also warned researchers about the questionnaire. The USGS questionnaire asks, for example, whether the researcher’s organisation works with ‘entities associated with communist, socialist, or totalitarian parties’, whether the research project has taken ‘appropriate measures’ to ‘defend against gender ideology’ and whether the project has ‘measurable benefits for US domestic industries, workforce, or economic sectors’.

↫ Universiteit Leiden

Researchers trying to enter the United States are also facing intimidation tactics, with the United States government going so far as to refuse entry to scientists critical of the Trump regime:

A French scientist was denied entry to the US this month after immigration officers at an airport searched his phone and found messages in which he had expressed criticism of the Trump administration, said a French minister.

“I learned with concern that a French researcher who was traveling to a conference near Houston was denied entry to the United States before being expelled,” Philippe Baptiste, France’s minister of higher education and research, said in a statement on Monday to Agence France-Presse published by Le Monde.

↫ Robert Mackey at the Guardian

Being denied entry is one thing – being arrested and sent to a string of prisons is another, like this Canadian woman:

Our next stop was Arizona, the San Luis Regional Detention Center. The transfer process lasted 24 hours, a sleepless, grueling ordeal. This time, men were transported with us. Roughly 50 of us were crammed into a prison bus for the next five hours, packed together – women in the front, men in the back. We were bound in chains that wrapped tightly around our waists, with our cuffed hands secured to our bodies and shackles restraining our feet, forcing every movement into a slow, clinking struggle.

↫ Jasmine Mooney at the Guardian

If you’re a scientist or researcher planning on going to a conference in the US (or, say, a developer wanting to go to a tech conference), you should reconsider. Even if your papers are in order, you could end up on a plane to a concentration camp in El Salvador before you can even call a lawyer – while being told that any judge standing up for your rights should be impeached.

The United States’ war on free speech, science, and research goes far beyond intimidating individual scientists and researchers. The Trump regime is actively erasing and deleting entire fields of science, most notably anything involving things like climate and gender, and openly attacking and cutting funding to universities that disagree with the Trump regime.

Almost immediately after being sworn in as president on 20 January, Trump put his signature to piles of executive orders cancelling or freezing tens of billions of dollars in funding for research and international assistance, and putting the seal on thousands of lay-offs. Orwellian restrictions have been placed on research, including bans on studies that mention particular words relating to sex and gender, race, disability and other protected characteristics.

↫ Nature

US President Donald Trump’s latest war on the climate includes withdrawing support for any research that mentions the word.

He has also launched a purge on government websites hosting climate data, in an apparent attempt to make the evidence disappear.

↫ Corey J. A. Bradshaw at The Conversation

The Trump administration has fired hundreds of workers at the National Oceanic and Atmospheric Administration (Noaa), the US’s pre-eminent climate research agency housed within the Department of Commerce, the Guardian has learned.

[…]

“There is no plan or thought into how to continue to deliver science or service on weather, severe storms and events, conservation and management of our coasts and ocean life and much more,” he said. “Let’s not pretend this is about efficiency, quality of work or cost savings because none of those false justifications are remotely true.”

↫ Dharna Noor and Gabrielle Canon at the Guardian

Intimidating current scientists isn’t enough, either – the scientists of the future must also suffer:

US President Donald Trump has signed an executive orderto dismantle the Department of Education, fulfilling a campaign pledge and a long-cherished goal of some conservatives.

[…]

In its statement, the American Federation of Teachers said: “No-one likes bureaucracy, and everyone’s in favour of more efficiency, so let’s find ways to accomplish that.

“But don’t use a ‘war on woke’ to attack the children living in poverty and the children with disabilities.”

↫ Ana Faguy at the BBC

But what about intimidating university students who don’t fall in line with the regime? Well, we can’t forget about those, now, can we?

After immigration agents detained Columbia University graduate student Mahmoud Khalil over his involvement in pro-Palestine protests on campus, President Donald Trump promised it was just the beginning. The Department of Homeland Security (DHS) has since arrested at least two more students who are in the country on visas — one of whom had recently sued the Trump administration on First Amendment grounds.

↫ Gaby Del Valle at The Verge

A Cornell University PhD student earlier this month sued the Trump administration seeking to stop the president’s order aimed at foreign students accused of “antisemitism”. Days later, lawyers at the justice department emailed to request that the student “surrender” to immigration officials

↫ Maanvi Singh at the Guardian

These are just a small selection of stories, and I could’ve picked a dozen more still if I wanted to. The point should be squarely (roundly?) driven home by now: the United States government seems to be doing everything in its power to scare off the very people an economy based on science, technology, and innovation needs to thrive, and this hasn’t exactly gone by unnoticed in the rest of the world.

It started with individual universities in Europe stepping up to attract US researchers and scientists, like the Vrije Universiteit Brussel in Belgium:

The Vrije Universiteit Brussel (VUB) is opening 12 postdoctoral positions for international researchers, with a specific focus on American scholars working in socially significant fields. These prestigious fellowships come with substantial funding (€2.5 million) as part of the European Marie Skłodowska-Curie (MSCA) program. Additionally, as part of the Brains for Brussels initiative of Innoviris, VUB aims to actively attract American professors looking to relocate. In collaboration with its Francophone sister university ULB, VUB is also providing 18 apartments for international researchers seeking temporary residence at the Brussels Institute for Advanced Studies.

VUB’s initiative is a response to the alarming political interference in academic research by the Trump administration in the U.S. The university is taking a firm stand against these developments.

↫ Vrije Universiteit Brussel

Another example, the Aix-Marseille Université in France:

In a context where some scientists in the United States may feel threatened or hindered in their research, our university is announcing the launch of the Safe Place For Science program, dedicated to welcoming scientists wishing to pursue their work in an environment conducive to innovation, excellence and academic freedom.

↫ Aix-Marseille Université

It seems universities the world over are seeing an increase in applicants trying to escape the purges in the United States:

Universities around the world have reported seeing an uptick in applications from U.S.-based researchers, who face an increasingly uncertain climate under President Donald Trump’s administration. And some countries and their institutions are already looking to use the opportunity to attract new talent and reverse the steady migration of scientists to the U.S. in recent decades.

↫ Catherine Offord at Science

Governments in Europe soon picked up on this, and are now asking the European Union to launch concerted efforts to attract scientists and researchers fleeing the United States:

In a letter addressed to research commissioner Ekaterina Zaharieva on Wednesday and seen by Science|Business, 13 governments asked the EU to show solidarity and welcome “brilliant talents from abroad who might suffer from research interference and ill-motivated and brutal funding cuts.”

“The current international context reminds us that freedom of science can be put at risk anywhere and at any time,” they wrote. While the new US administration is not named in the letter, the implication is clear.

↫ Juliette Portala and David Matthews at Science|Business

Curtailing freedom of speech and attacking academic freedom are classic elements of the authoritarian and fascist playbooks, and the end result is always the same: a massive brain drain as academia are either murdered, sent to work the fields, or in less extreme cases like what’s happening in the United States today, flee the country to offer their knowledge and expertise elsewhere. The effects of brain drain are well-understood, and will impact the economy of the United States harshly; especially the very technology companies supporting the Trump regime will start feeling the squeeze as it becomes harder and harder for them to attract the top talent they need. In fact, they’re already worried about what they have wrought.

Freedom of speech and academic freedom are under heavy assault in the United States, and it’s going to affect every American, from researchers and academics, down to classic cases of “I never thought leopards would eat my face”, like when a Trump voter saw his wife arrested, facing deportation to Peru (he still supports Trump, and doesn’t regret his vote – that’s going to make for interesting dinner conversation).

Authoritarian purges employ hatchets, not scalpels, and every American in the bottom 80% is going to suffer the consequences.

KDE developers show off SDDM replacement

KDE’s login manager, SDDM, has its share of problems, and as such, a number of KDE developers are working on replacement to fix many of these long-standing issues. So, what exactly is wrong with SDDM as it exists today?

With SDDM, power management is reinvented from scratch with bespoke configuration. We can’t integrate with Plasma’s network management, power management, volume controls, or brightness controls without reinventing them in the desktop-agnostic backend.

SDDM was already having to duplicate too much functionality we have in KDE, which was very frustrating when we’re left maintaining it.

↫ David Edmundson

On top of that, theming is also a big issue with SDDM, as it doesn’t adopt any of the existing Plasma themes, wallpapers, and so on, forcing users to manually makes thse changes for SDDM, and forcing theme developers to make custom themes just for SDDM instead of it just adopting Plasma’s settings. The new login manager they’re working on will instead make use of existing Plasma components and be brought up like Plasma itself, too.

For now, the SDDM replacement is roughly at feature parity with SDDM, but it’s by no means ready for widespread adoption by distributions or users. Developers interested in trying it out can do so, though, and as it mostly looks like the existing default SDDM setup, you won’t even notice anything in day-to-day use.

Google moves all Android development behind closed doors

Up until now, Google developed several components of Android out in the open, as part of AOSP, while developing everything else behind closed doors, only releasing the source code once the final new Android version was released. This meant that Google had to merge the two branches, which lead to problems and issues, so Google decided it’s now moving all development of Android behind closed doors.

What will change is the frequency of public source code releases for specific Android components. Some components like the build system, update engine, Bluetooth stack, Virtualization framework, and SELinux configuration are currently AOSP-first, meaning they’re developed fully in public. Most Android components like the core OS framework are primarily developed internally, although some features, such as the unlocked-only storage area API, are still developed within AOSP.

Beginning next week, all Android development will occur within Google’s internal branches, and the source code for changes will only be released when Google publishes a new branch containing those changes. As this is already the practice for most Android component changes, Google is simply consolidating its development efforts into a single branch.

↫ Mishaal Rahman at Android Authority

This brings up a very old debate: if development happens entirely behind closed doors, with only the occasional code drop, is the software in question really open source? Technically, the answer is obviously ‘yes’ – there’s no requirement that development take place in public. However, I’m fairly sure that when most people think of open source, they think not only of occasionally throwing chunks of code over the proverbial corporate walls, but also of open development, where everybody is free to contribute, pipe in, and follow along.

Clearly, this move makes Android more closed, not less so, and it follows in a long string of changes Google has made to Android that make it ever harder to consider AOSP, the Android Open Source Project, a capable, modern mobile operating system. The Android fork of the Linux kernel will always be properly open, of course, but I have my doubts Android in and of itself will remain open source in the narrow definition for much longer, and even if it does, you have to wonder how much value it will have.

I mean, Darwin, the open source base underneath macOS and iOS, is technically open source, but nobody cares because Apple made it pretty much worthless in and of itself. Anything of value is stripped out and not only developed behind closed doors, but also not released as open source, ensuring Darwin is nothing but a curiosity we sometimes remember exists. Android could be heading in the same direction.

My biggest worry are Android ROMs, most notably for me personally GrapheneOS. I honestly have no idea how this will impact such projects.

How NixOS and reproducible builds could have detected the xz backdoor for the benefit of all

Some more light reading:

While it was already established that the open source supply chain was often the target of malicious actors, what is stunning is the amount of energy invested by Jia Tan to gain the trust of the maintainer of the xz project, acquire push access to the repository and then among other perfectly legitimate contributions insert – piece by piece – the code for a very sophisticated and obfuscated backdoor. This should be a wake up call for the OSS community. We should consider the open source supply chain a high value target for powerful threat actors, and to collectively find countermeasures against such attacks.

In this article, I’ll discuss the inner workings of the xz backdoor and how I think we could have mechanically detected it thanks to build reproducibility.

↫ Julien Malka

It’s a very detailed look at the situation and what Nix could to prevent it in the future.

Playing multimedia with Dillo

What if you want to use a web browser like Dillo, which lacks JavaScript support and can’t play audio or video inside the browser?

Dillo doesn’t have the capability to play audio or video directly from the browser, however it can easily offload this task to other programs. This page collects some examples of how to do watch videos and listen to audio tracks or podcasts by using an external player program. In particular we will cover mpv with yt-dlp which supports YouTube and Bandcamp among many other sites.

↫ Dillo website

The way Dillo handles this feels very UNIX-y, in that it will call an external program – mpv and yt-dlp, for instance – to play a YouTube from an “Open in mpv” option in the right-click menu for a link. It’s nothing earth-shattering or revolutionary, of course, but I very much appreciate that Dillo bakes this functionality right in, allowing you to define any such actions and add them to the context menu.

The seL4 microkernel: an introduction

This whitepaper provides an introduction to and overview of seL4. We explain what seL4 is (and is not) and explore its defining features. We explain what makes seL4 uniquely qualified as the operating-system kernel of choice for security- and safety-critical systems, and generally embedded and cyber-physical systems. In particular, we explain seL4’s assurance story, its security- and safety-relevant features, and its benchmark-setting performance. We also discuss typical usage scenarios, including incremental cyber retrofit of legacy systems.

↫ Gernot Heiser

Some light reading for Monday.

ReactOS 0.4.15 released

It’s been over three years since the last ReactOS release, but today, in honour of the first commit to the project by the oldest, still active contributor, the project released ReactOS 0.4.15. Of course, there’s been a steady stream of nightly releases, so it’s not like the project stalled or anything, but having a proper release is always nice to have.

We are pleased to announce the release of ReactOS 0.4.15! This release offers Plug and Play fixes, audio fixes, memory management fixes, registry healing, improvements to accessories and system tools including Notepad, Paint, RAPPS, the Input Method Editor, and shell improvements.

↫ ReactOS 0.14.5 release announcement

There’s a lot in this one, as the long gap between releases indicates. Thanks to the major changes in the plug and play subsystem of the kernel, ReactOS now supports more third party drivers, and it can now boot from USB and chipsets with EHCI, OHCI, and UHCI controllers. The open source AC’97 driver from the Windows Driver Kit has also been ported to ReactOS to enable sound on VirtualBox and old motherboards. The open source FAT driver from the same WDK has also been ported, which is a massive improvement over the old one. ReactOS can now also make use of custom IMEs, ZIP archive support has been integrated into the shell, and a new default visual style has been chosen.

There’s a lot more in this release, though, and since it was branched over six months ago, there are a lot of improvements from since that time that are not yet part of this release, like a graphical installers, UEFI and SMP support, new NTFS driver, and a ton more. In other words – don’t let the long time between releases fool you; there’s a lot going on in the ReactOS world.

Nvidia Linux GPU driver ported to Haiku

Nvidia releasing its Linux graphics driver as open source is already bearing fruit for alternative operating systems.

As many people already knows, Nvidia published their kernel driver under MIT license: GitHub – NVIDIA/open-gpu-kernel-modules: NVIDIA Linux open GPU kernel module source (I will call it NVRM). This driver is very portable and its platform-independent part can be compiled for Haiku with minor effort (but it need to implement OS-specific binding code to be actually useful). This is very valuable for Haiku because Linux kernel GPU drivers are very hard to port and it heavily depends on Linux kernel internals. Unfortunately userland OpenGL/Vulkan driver source code is not published. But as part of Mesa 3D project, new Vulkan driver “NVK” is being developed and is functional already. Mesa NVK driver is using Nouveau as kernel driver, so it can’t be directly used with NVRM kernel driver. NVK source code provides platform abstraction that allows to implement support of other kernel drivers such as NVRM.

I finally managed to make initial port NVRM kernel driver to Haiku and added initial NVRM API support to Mesa NVK Vulkan driver, so NVRM and NVK can work together. Some simple Vulkan tests are working.

↫ X512 on the Haiku forums

Incredibly impressive, and a huge milestone for the Haiku operating system. It supports any Nvidia GPU from the Turing architecture, which I think means Nvidia RTX 20xx and newer, since they have a required microcontroller older GPUs do not have. Of course, this is an early port and a lot of work remains to be done, but it could lead to huge things for Haiku.

SoftBank acquires Ampere Computing

SoftBank Group Corp. today announced that it will acquire Ampere Computing, a leading independent silicon design company, in an all-cash transaction valued at $6.5 billion. Under the terms of the agreement, Ampere will operate as a wholly owned subsidiary of SoftBank Group and retain its name. As part of the transaction, Ampere’s lead investors – Carlyle and Oracle – are selling their respective positions in Ampere.

↫ SoftBank and Ampere Computing press release

Despite not really knowing what SoftBank does and what their long-term goals are – I doubt anyone does – I hope this at the very least provides Ampere with the funds needed to expand its business. At this point, the only serious options for Arm-based hardware are either Apple or Qualcomm, and we could really use more players. Ampere’s hardware is impressive, but difficult to buy and expensive, and graphics card support is patchy, at best.

What Ampere needs is more investment, and more OEMs picking up their chips. An Ampere workstation is incredibly high on my list of machines to test for OSNews (perhaps a System76 model?), and it’d be great if economies of scale worked to bring the prices down, possibly allowing Ampere to developer cheaper, more affordable variants for us mere mortals, too. I would love to build an Arm workstation in much the same way we build regular x86 PCs today, but I feel like that’s still far off.

I have no idea if SoftBank is the right kind of company to make this possible, but one can dream.

FOSS infrastructure is under attack by AI companies

What do SourceHut, GNOME’s GitLab, and KDE’s GitLab have in common, other than all three of them being forges? Well, it turns out all three of them have been dealing with immense amounts of traffic from “AI” scrapers, who are effectively performing DDoS attacks with such ferocity it’s bringing down the infrastructures of these major open source projects. Being open source, and thus publicly accessible, means these scrapers have unlimited access, unlike with proprietary projects.

These “AI” scrapers do not respect robots.txt, and have so many expensive endpoints it’s putting insane amounts of pressure on infrastructure. Of course, they use random user agents from an effectively infinite number of IP addresses. Blocking is a game of whack-a-mole you can’t win, and so the GNOME project is using a rather nuclear option called Anubis now, which aims to block “AI” scrapers with a heavy-handed approach that sometimes blocks real, genuine users as well.

The numbers are insane, as Niccolò Venerandi at Libre News details.

Over Mastodon, one GNOME sysadmin, Bart Piotrowski, kindly shared some numbers to let people fully understand the scope of the problem. According to him, in around two hours and a half they received 81k total requests, and out of those only 3% passed Anubi’s proof of work, hinting at 97% of the traffic being bots – an insane number!

↫ Niccolò Venerandi at Libre News

Fedora is another project dealing with these attacks, with infrastructure sometimes being down for weeks as a result. Inkscape, LWN, Frama Software, Diaspora, and many more – they’re all dealing with the same problem: the vast majority of the traffic to their websites and infrastructure now comes from attacks by “AI” scrapers. Sadly, there’s doesn’t seem to be a reliable way to defend against these attacks just yet, so sysadmins and webmasters are wasting a ton of time, money, and resources fending off the hungry “AI” hordes.

These “AI” companies are raking in billions and billions of dollars from investors and governments the world over, trying to build dead-end text generators while sucking up huge amounts of data and wasting massive amounts of resources from, in this case, open source projects. If no other solutions can be found, the end game here could be that open source projects will start to make their bug reporting tools and code repositories much harder and potentially even impossible to access without jumping through a massive amount of hoops.

Everything about this “AI” bubble is gross, and I can’t wait for this bubble to pop so a semblance of sanity can return to the technology world. Until the next hype train rolls into the station, of course.

As is tradition.

Memory safety for web fonts in Chrome: Google replaces FreeType with Rust-based alternative

There’s no escaping Rust, and the language is leaving its mark everywhere. This time around, Chrome has replaced its use of FreeType with Skrifa, a Rust-based replacement.

Skrifa is written in Rust, and created as a replacement for FreeType to make font processing in Chrome secure for all our users. Skifra takes advantage of Rust’s memory safety, and lets us iterate faster on font technology improvements in Chrome. Moving from FreeType to Skrifa allows us to be both agile and fearless when making changes to our font code. We now spend far less time fixing security bugs, resulting in faster updates, and better code quality.

↫ Dominik Röttsches, Rod Sheeter, and Chad Brokaw

The move to Skrifa is already complete, and it’s being used now by Chrome users on Linux, Android, and ChromeOS, and as a fallback for users on Windows and macOS. The reasons for this change are the same as they always are for replacing existing tools with new tools written in Rust: security. FreeType is a security risk for Chrome, and by replacing it with something written in a memory-safe language like Rust, Google was able to eliminate a whole slew of types of security issues.

To ensure rendering correctness, Google performed a ton of pixel comparison tests to compare FreeType output to Skrifa output. On top of that, Google is continuously running similar tests to ensure no quality degradation sneaks into Skrifa as time progresses.

Whether anyone likes Rust or not, the reality of the matter is that using Rust provides tangible benefits that reduce cost and lower security risks, and as such, its use will keep increasing, and tried and true tools will continue to be replaced by Rust counterparts.

I think we need a bigger boot partition

Long ago, during the time of creation, I confidently waved my hand and allocated a 1GB ESP partition and a 1GB boot partition, thinking to myself with a confident smile that this would surely be more than enough for the foreseeable future. However, this foreseeable future quickly vanished along with my smile. What was bound to happen eventually came, but I didn’t expect it to arrive so soon. What could possibly require such a large boot partition? And how should we resolve this? Here, I would like to introduce the boot partition issue I encountered, as well as temporary coping methods and final solutions, mentioning the problems encountered along the way for reference.

↫ fernvenue

Some of us will definitely run into this issue at some point, so if you’re doing a fresh installation it might make sense to allocate a bit more space to your boot partition. If you have a running system and are bumping into the limitations of your boot partition and don’t want to reinstall, the linked article provides some possible solutions.

GNOME 48 released

One of the two major open source desktop environments, GNOME, just released version 48, and it’s got some very big and welcome improvements. First and foremost there’s dynamic triple-buffering, a feature that took over five years of extensive testing to get ready. It will improve the smoothness and fluidity of animations and other movements on the screen, as it did for KDE when it landed there in the middle of last year.

GNOME 48 also brings notification stacking, combining notifications from the same source, improvements to the new default image viewer such as image editing features, a number of digital well-being options, as well as the introduction of a new, basic audio player designed explicitly for quickly playing individual audio files. There’s also a few changes to GNOME’s text editor, and following in KDE’s recent footsteps, GNOME 48 also brings HDR support.

Another major change are the new default fonts. Finally, Cantarell is gone, replaced by slightly modified versions of Inter and Iosevka. Considering I absolutely adore Inter and installing and setting it as my main font is literally the first thing I do on any system that allows me to, I’m fully behind this change. Inter is exceptional in that it renders great in both high and low DPI environments, and its readability is outstanding.

GNOME 48 will make its way to your distribution’s repositories soon enough.

Java 24 released

Oracle, the company owned by a guy who purchased a huge chunk of the Kingdom of Hawaii from the Americans, has released Java 24. I’ll be honest and upfront: I just don’t care very much at all about this, as the only interaction I’ve had with Java over the past, I don’t know, 15 years or so, is either because of Minecraft, or because of my obsession with ancient UNIX workstations where Java programs pop up in the weirdest of places. I know Java is massive and used everywhere, but going through the list of changes and improvements does not spark any joy in me at all, and just makes me want to stick my pinky in an electrical socket to make something interesting happen.

If you work with Java, you know all of this stuff already anyway, as you’ve been excitedly trying to impress Nick from accounting with your knowledge of Flexible Constructor Bodies and Quantum-Resistant Module-Lattice-Based Key Encapsulation Mechanisms because he’s just so dreamy and you desperately want to ask him out for a hot cup of coffee, but you’re not sure if he’s married or has a boy or girlfriend so you’re just kind of scoping things out a bit too excitedly and now you’re worried you might be coming off as too desperate for his attention.

Anyway, that’s how offices work, right? I’ve never worked for anyone but myself and office settings induce a deep sense of existential dread in me, so my knowledge of office work, and Java if we’re honest, may be based a bit too much on ’90s sitcoms and dramas. Whatever, Java 24 is here. Do a happy dance.

After 47 years, OpenVMS gets a package manager

As of the 18th of February, OpenVMS, known for its stability and high-availability, 47 years old and ported to 4 different CPU architecture, has a package manager! This article shows you how to use the package manager and talks about a few of its quirks. It’s an early beta version, and you do notice that when using it. A small list of things I noticed, coming from a Linux (apt/yum/dnf) background: There seems to be no automatic dependency resolution and the dependencies it does list are incomplete. No update management yet, no removal of packages and no support for your own package repository, only the VSI official one. Service startup or login script changes are not done automatically. Packages with multiple installer files fail and require manual intervention. It does correctly identify the architectures, has search support and makes it way easier to install software. The time saved by downloading, manually copying and starting installation is huge, so even this early beta is a very welcome addition to OpenVMS.

↫ Remy van Elst

Obviously, a way to install software packages without having to manually download them is a huge step forward for OpenVMS. The listed shortcomings might raise some eyebrows considering most of us are used to package management on Linux/BSD, which is far more advanced. Bear in mind, however, that this is a beta product, and it’s quite obvious these missing essential features will be added over time. Luckily it at least lists dependencies, so let’s hope actually automating installing them is in the works and will be available soon.

I actually have an OpenVMS virtual machine set up and running, but I find using it incredibly difficult – but only because of my own lack of experience with and knowledge about OpenVMS, of course. Any experience of knowledge rooted in UNIX-based and Windows operating systems is useless here, even for the most basic of CLI tasks. If I find the time, I’d love to spend more time with it and get more acquainted with the way it works, including this new package manager.